feat(auth): add signIn rate-limit backfill with dual ip/account budgets

Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/src/application/use-cases/sign-in.use-case.test.ts

@@ -6,9 +6,14 @@ import {
 } from "@/application/use-cases/sign-in.use-case";
 import { MockUsersRepository } from "@/infrastructure/repositories/users.repository.mock";
 import { MockAuthenticationService } from "@/infrastructure/services/authentication.service.mock";
-import { AuthenticationError } from "@/entities/errors/auth";
+import {
+  AuthenticationError,
+  TooManyRequestsError,
+} from "@/entities/errors/auth";
 import type { IAuthenticationService } from "@/application/services/authentication.service.interface";
 import { userFactory } from "@/__factories__/user.factory";
+import { NoopRateLimit, InMemoryRateLimit } from "@repo/core-shared/rate-limit";
+import { RecordingRateLimit } from "@repo/core-testing/rate-limit";
 
 describe("signInUseCase", () => {
   it("returns a session + cookie on valid credentials", async () => {
@@ -20,7 +25,7 @@ describe("signInUseCase", () => {
     });
     await users.createUser(seedUser);
 
-    const useCase = signInUseCase(users, auth);
+    const useCase = signInUseCase(users, auth, new NoopRateLimit());
     const result = await useCase({
       username: "alice",
       password: "testpassword",
@@ -33,7 +38,7 @@ describe("signInUseCase", () => {
   it("throws AuthenticationError when user does not exist", async () => {
     const users = new MockUsersRepository([]);
     const auth = new MockAuthenticationService(users);
-    const useCase = signInUseCase(users, auth);
+    const useCase = signInUseCase(users, auth, new NoopRateLimit());
 
     await expect(
       useCase({ username: "ghost", password: "anything" }),
@@ -50,11 +55,99 @@ describe("signInUseCase", () => {
       }),
     );
 
-    const useCase = signInUseCase(users, auth);
+    const useCase = signInUseCase(users, auth, new NoopRateLimit());
     await expect(
       useCase({ username: "alice", password: "wrong" }),
     ).rejects.toBeInstanceOf(AuthenticationError);
   });
+
+  it("captures both ip and account consume calls via RecordingRateLimit", async () => {
+    const users = new MockUsersRepository([]);
+    const auth = new MockAuthenticationService(users);
+    const rl = new RecordingRateLimit();
+    const seedUser = userFactory.build({
+      username: "alice",
+      passwordHash: "hashed_testpassword",
+    });
+    await users.createUser(seedUser);
+
+    const useCase = signInUseCase(users, auth, rl);
+    await useCase({
+      username: "alice",
+      password: "testpassword",
+      clientIp: "1.2.3.4",
+    });
+
+    expect(rl.consumeCalls).toHaveLength(2);
+    expect(rl.consumeCalls[0]).toMatchObject({
+      budgetName: "ip",
+      key: "signIn:ip:1.2.3.4",
+    });
+    expect(rl.consumeCalls[1]).toMatchObject({
+      budgetName: "account",
+      key: "signIn:account:alice",
+    });
+  });
+
+  it("throws TooManyRequestsError when ip budget is exhausted", async () => {
+    const users = new MockUsersRepository([]);
+    const auth = new MockAuthenticationService(users);
+    const rl = new InMemoryRateLimit([
+      { name: "ip", window: "1m", budget: 1 },
+      { name: "account", window: "1h", budget: 10 },
+    ]);
+    const seedUser = userFactory.build({
+      username: "alice",
+      passwordHash: "hashed_testpassword",
+    });
+    await users.createUser(seedUser);
+
+    const useCase = signInUseCase(users, auth, rl);
+    await useCase({
+      username: "alice",
+      password: "testpassword",
+      clientIp: "1.2.3.4",
+    });
+
+    await expect(
+      useCase({
+        username: "alice",
+        password: "testpassword",
+        clientIp: "1.2.3.4",
+      }),
+    ).rejects.toBeInstanceOf(TooManyRequestsError);
+  });
+
+  it("throws TooManyRequestsError when account budget is exhausted", async () => {
+    const users = new MockUsersRepository([]);
+    const auth = new MockAuthenticationService(users);
+    const rl = new InMemoryRateLimit([
+      { name: "ip", window: "1m", budget: 100 },
+      { name: "account", window: "1h", budget: 1 },
+    ]);
+    const seedUser = userFactory.build({
+      username: "alice",
+      passwordHash: "hashed_testpassword",
+    });
+    await users.createUser(seedUser);
+
+    const useCase = signInUseCase(users, auth, rl);
+    // First call succeeds (ip allows, account allows, credentials ok)
+    await useCase({
+      username: "alice",
+      password: "testpassword",
+      clientIp: "1.2.3.4",
+    });
+
+    // Second call: ip still allows (high budget), account is exhausted
+    await expect(
+      useCase({
+        username: "alice",
+        password: "testpassword",
+        clientIp: "5.6.7.8",
+      }),
+    ).rejects.toBeInstanceOf(TooManyRequestsError);
+  });
 });
 
 describe("signInUseCase output validation", () => {
@@ -69,7 +162,7 @@ describe("signInUseCase output validation", () => {
       createSession: async () => ({ session: { id: 123 }, cookie: null }),
     } as unknown as IAuthenticationService;
 
-    const useCase = signInUseCase(users, auth);
+    const useCase = signInUseCase(users, auth, new NoopRateLimit());
     await expect(
       useCase({ username: "alice", password: "x" }),
     ).rejects.toBeInstanceOf(ZodError);

packages/auth/src/application/use-cases/sign-in.use-case.ts

@@ -1,6 +1,10 @@
 import { z } from "zod";
 
-import { AuthenticationError } from "../../entities/errors/auth";
+import type { IRateLimit } from "@repo/core-shared/rate-limit";
+import {
+  AuthenticationError,
+  TooManyRequestsError,
+} from "../../entities/errors/auth";
 import { cookieSchema } from "../../entities/models/cookie";
 import { sessionSchema } from "../../entities/models/session";
 import type { IUsersRepository } from "../repositories/users.repository.interface";
@@ -11,6 +15,7 @@ export const signInInputSchema = z
   .object({
     username: z.string().min(3).max(31),
     password: z.string().min(6).max(255),
+    clientIp: z.string().optional(),
   })
   .strict();
 export type SignInInput = z.infer<typeof signInInputSchema>;
@@ -26,9 +31,28 @@ export type SignInOutput = z.infer<typeof signInOutputSchema>;
 export type ISignInUseCase = ReturnType<typeof signInUseCase>;
 
 export const signInUseCase =
-  (usersRepository: IUsersRepository, authenticationService: IAuthenticationService) =>
+  (
+    usersRepository: IUsersRepository,
+    authenticationService: IAuthenticationService,
+    rateLimit: IRateLimit,
+  ) =>
   async (input: SignInInput): Promise<SignInOutput> => {
-    const existingUser = await usersRepository.getUserByUsername(input.username);
+    const { allowed: ipAllowed } = await rateLimit.consume(
+      "ip",
+      `signIn:ip:${input.clientIp ?? ""}`,
+    );
+    if (!ipAllowed) throw new TooManyRequestsError("Too many sign-in attempts");
+
+    const { allowed: accountAllowed } = await rateLimit.consume(
+      "account",
+      `signIn:account:${input.username}`,
+    );
+    if (!accountAllowed)
+      throw new TooManyRequestsError("Too many sign-in attempts");
+
+    const existingUser = await usersRepository.getUserByUsername(
+      input.username,
+    );
     if (!existingUser) {
       throw new AuthenticationError("User does not exist");
     }

packages/auth/src/di/bind-dev-seed.ts

@@ -10,6 +10,7 @@ import {
   assertFeatureConformance,
   wireUseCase,
 } from "@repo/core-shared/conformance";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { authManifest } from "../feature.manifest.js";
 import { authContainer } from "./container.js";
 import { AUTH_SYMBOLS } from "./symbols.js";
@@ -85,12 +86,13 @@ export async function bindDevSeedAuth(ctx: BindContext): Promise<void> {
     container: authContainer,
     symbol: AUTH_SYMBOLS.ISignInUseCase,
     factory: signInUseCase,
-    deps: [repo, authService],
+    deps: [repo, authService, ctx.rateLimit ?? new NoopRateLimit()],
     feature: "auth",
     layer: "use-case",
     name: "signIn",
     tracer,
     logger,
+    rateLimit: ctx.rateLimit ?? new NoopRateLimit(),
   });
   const wrappedSignUp = wireUseCase({
     container: authContainer,

packages/auth/src/di/bind-production.ts

@@ -10,6 +10,7 @@ import {
   assertFeatureConformance,
   wireUseCase,
 } from "@repo/core-shared/conformance";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { authManifest } from "../feature.manifest";
 import { authContainer } from "./container";
 import { AUTH_SYMBOLS } from "./symbols";
@@ -77,12 +78,13 @@ export function bindProductionAuth(ctx: BindProductionContext): void {
     container: authContainer,
     symbol: AUTH_SYMBOLS.ISignInUseCase,
     factory: signInUseCase,
-    deps: [repo, authService],
+    deps: [repo, authService, ctx.rateLimit ?? new NoopRateLimit()],
     feature: "auth",
     layer: "use-case",
     name: "signIn",
     tracer,
     logger,
+    rateLimit: ctx.rateLimit ?? new NoopRateLimit(),
   });
   const wrappedSignUp = wireUseCase({
     container: authContainer,

packages/auth/src/di/bind-production.types.test.ts

@@ -19,7 +19,8 @@ describe("auth.signIn binding slot (type-level)", () => {
     // It returns a function with no brand attached — must not be assignable.
     const fakeRepo = {} as never;
     const fakeAuth = {} as never;
-    const unwrapped = signInUseCase(fakeRepo, fakeAuth);
+    const fakeRateLimit = {} as never;
+    const unwrapped = signInUseCase(fakeRepo, fakeAuth, fakeRateLimit);
 
     // @ts-expect-error — unwrapped factory has no __instrumented / __captured brand
     const _bad: Slot = unwrapped;

packages/auth/src/di/module.ts

@@ -1,5 +1,6 @@
 import { ContainerModule, type interfaces } from "inversify";
 
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import type { IUsersRepository } from "../application/repositories/users.repository.interface";
 import type { IAuthenticationService } from "../application/services/authentication.service.interface";
 import { MockUsersRepository } from "../infrastructure/repositories/users.repository.mock";
@@ -42,6 +43,7 @@ export const AuthModule = new ContainerModule((bind: interfaces.Bind) => {
       ctx.container.get<IAuthenticationService>(
         AUTH_SYMBOLS.IAuthenticationService,
       ),
+      new NoopRateLimit(),
     ),
   );
 

packages/auth/src/entities/errors/auth.ts

@@ -18,3 +18,10 @@ export class UnauthorizedError extends Error {
     this.name = "UnauthorizedError";
   }
 }
+
+export class TooManyRequestsError extends Error {
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = "TooManyRequestsError";
+  }
+}

packages/auth/src/entities/errors/errors.test.ts

@@ -3,6 +3,7 @@ import {
   AuthenticationError,
   UnauthenticatedError,
   UnauthorizedError,
+  TooManyRequestsError,
 } from "./auth";
 import { InputParseError } from "./common";
 
@@ -37,3 +38,12 @@ describe("InputParseError", () => {
     expect(err.message).toBe("invalid input");
   });
 });
+
+describe("TooManyRequestsError", () => {
+  it("is an instance of Error with the given message", () => {
+    const err = new TooManyRequestsError("too many attempts");
+    expect(err).toBeInstanceOf(Error);
+    expect(err.message).toBe("too many attempts");
+    expect(err.name).toBe("TooManyRequestsError");
+  });
+});

packages/auth/src/feature.manifest.ts

@@ -21,6 +21,10 @@ export const authManifest = defineFeature({
       audits: [],
       publishes: [],
       consumes: [],
+      rateLimit: [
+        { name: "ip", window: "1m", budget: 5 },
+        { name: "account", window: "1h", budget: 10 },
+      ],
     },
     signUp: {
       mutates: true,

packages/auth/src/index.ts

@@ -6,6 +6,7 @@ export {
   AuthenticationError,
   UnauthenticatedError,
   UnauthorizedError,
+  TooManyRequestsError,
 } from "./entities/errors/auth";
 export { InputParseError } from "./entities/errors/common";
 export { SESSION_COOKIE } from "./config";

packages/auth/src/integrations/api/procedures.ts

@@ -5,6 +5,7 @@ import {
   AuthenticationError,
   UnauthenticatedError,
   UnauthorizedError,
+  TooManyRequestsError,
 } from "../../entities/errors/auth";
 import { InputParseError } from "../../entities/errors/common";
 
@@ -14,5 +15,6 @@ export const authProcedure = t.procedure.use(
     [AuthenticationError, "UNAUTHORIZED"],
     [UnauthenticatedError, "UNAUTHORIZED"],
     [UnauthorizedError, "FORBIDDEN"],
+    [TooManyRequestsError, "TOO_MANY_REQUESTS"],
   ]),
 );

packages/auth/src/interface-adapters/controllers/sign-in.controller.test.ts

@@ -5,15 +5,19 @@ import { MockUsersRepository } from "@/infrastructure/repositories/users.reposit
 import { MockAuthenticationService } from "@/infrastructure/services/authentication.service.mock";
 import { InputParseError } from "@/entities/errors/common";
 import { userFactory } from "@/__factories__/user.factory";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 
 describe("signInController", () => {
   it("returns a cookie on successful sign-in", async () => {
     const users = new MockUsersRepository([]);
     const auth = new MockAuthenticationService(users);
-    const seedUser = userFactory.build({ username: "alice", passwordHash: "hashed_testpassword" });
+    const seedUser = userFactory.build({
+      username: "alice",
+      passwordHash: "hashed_testpassword",
+    });
     await users.createUser(seedUser);
 
-    const useCase = signInUseCase(users, auth);
+    const useCase = signInUseCase(users, auth, new NoopRateLimit());
     const controller = signInController(useCase);
 
     const result = await controller({
@@ -27,18 +31,22 @@ describe("signInController", () => {
   it("throws InputParseError on invalid input", async () => {
     const users = new MockUsersRepository([]);
     const auth = new MockAuthenticationService(users);
-    const useCase = signInUseCase(users, auth);
+    const useCase = signInUseCase(users, auth, new NoopRateLimit());
     const controller = signInController(useCase);
 
-    await expect(controller({ username: "ab" } as unknown)).rejects.toBeInstanceOf(InputParseError);
+    await expect(
+      controller({ username: "ab" } as unknown),
+    ).rejects.toBeInstanceOf(InputParseError);
   });
 
   it("throws InputParseError when input is not an object", async () => {
     const users = new MockUsersRepository([]);
     const auth = new MockAuthenticationService(users);
-    const useCase = signInUseCase(users, auth);
+    const useCase = signInUseCase(users, auth, new NoopRateLimit());
     const controller = signInController(useCase);
 
-    await expect(controller("garbage" as unknown)).rejects.toBeInstanceOf(InputParseError);
+    await expect(controller("garbage" as unknown)).rejects.toBeInstanceOf(
+      InputParseError,
+    );
   });
 });

packages/auth/tests/sign-in-flow.feature.test.ts

@@ -3,6 +3,7 @@
 
 import { describe, it, expect } from "vitest";
 import { RecordingEventBus } from "@repo/core-testing/instrumentation";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { MockUsersRepository } from "../src/infrastructure/repositories/users.repository.mock";
 import { MockAuthenticationService } from "../src/infrastructure/services/authentication.service.mock";
 import { signInUseCase } from "../src/application/use-cases/sign-in.use-case";
@@ -18,7 +19,9 @@ describe("auth feature: sign-up → sign-in → sign-out", () => {
     const users = new MockUsersRepository([]);
     const auth = new MockAuthenticationService(users);
 
-    const signIn = signInController(signInUseCase(users, auth));
+    const signIn = signInController(
+      signInUseCase(users, auth, new NoopRateLimit()),
+    );
     const signUp = signUpController(
       signUpUseCase(users, auth, new RecordingEventBus(), undefined),
     );